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We present and analyze a protocol for quantum steganography where the sender (Alice) encodes 
her steganographic information into the error syndromes of the perfect (five-qubit) quantum error- 
correcting code, and sends it to the receiver (Bob) over a depolarizing channel. Alice and Bob 
share a classical secret key, and hide quantum information in such a way that to an eavesdropper 
(Eve) without access to the secret key, the quantum message looks like an innocent codeword with 
a typical sequence of quantum errors. We calculate the average rate of key consumption, and show 
how the protocol improves in performance as information is spread over multiple codeword blocks. 
Alice and Bob utilize different encodings to optimize the average number of steganographic bits that 
they can send to each other while matching the error statistics of the depolarizing channel. 
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I. INTRODUCTION 

The art and science of information hiding or steganog- 
raphy has been around for centuries, if not millennia. 
The word itself comes from the Greek words steganos 
which means "covered," and graphia which means "writ- 
ing." The art of information hiding dates back to 440 
B.C. to the Greeks. In The Histories, Herodotus records 
two incidents of the use of steganography. In the first in- 
cident Demaratus a Greek king uses a wax tablet to warn 
the Spartans of an impending attack by the Persian king 
Xerxes [T]. Wax tablets were used as reusable writing 
surfaces and constructed from wooden bases. Demaratus 
scratched the steganographic message on the wood, and 
then covered it with beeswax. Once the Spartans received 
the wax tablet from the courier, all that they needed to 
do was to melt the wax and read the hidden warning. In 
another story Herodotus records how Histiaeus tattoos a 
secret message on the shaved scalp of his slave, and then 
waits for the hair to grow back before dispatching him 
to the Ionian city of Miletus. The ancient Chinese used 
a wooden mask with holes cut out at random places to 
use as a steganographic device. They would place the 
wooden block on a blank sheet of paper and after writ- 
ing the secret message in the holes they would fill in the 
blanks in the paper with regular text. The mask acted 
as a secret key to unlock the hidden message. In the 
seventeenth and eighteenth centuries, people hid secret 
messages in logarithm tables by introducing deliberate 
errors in the least significant digits. 

The term steganography was first used in 1499 by Jo- 
hannes Trithemius in his Steganographia which was one 
of the first treatises on the use of cryptographic and 
steganographic techniques 1^. The study of modern 
steganography was initiated by Simmons, who presented 
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it in terms of the following paradigm [3] . Alice and Bob 
are imprisoned in two different cells that are far apart. 
They would like to devise an escape plan but the only 
way they can communicate with each other is through a 
courier who is loyal to and under the command of the 
warden (Eve, the adversary) of the penitentiary. The 
courier leaks all information to the warden. If the warden 
suspects that either Alice or Bob are conspiring to escape 
from the penitentiary, she will cut off all communication 
between them, and move both of them to a maximum se- 
curity cell. It is assumed that prior to their incarceration 
Alice and Bob had access to a shared secret key which 
they will later exploit to send secret messages hidden in 
a cover text. Can Alice and Bob devise an escape plan 
without arousing the suspicion of the warden? 

Steganography is inherently different from cryptogra- 
phy. In cryptography, an encryption algorithm acts on 
the secret message, utilizing a key (private or public). 
The resulting message (or "ciphertext" ') looks like gib- 
berish to an eavesdropper (Eve) who does not have access 
to the secret key. However, by observing that the trans- 
mitted ciphertext is gibberish. Eve can conclude that 
the message contains private information. By contrast, 
in steganography we do not necessarily need to encrypt 
the secret message. Rather, we hide it within a larger 
plaintext message, often referred to as the "covertext" 
or "cover-work." The resulting message, or "stego-text," 
appears to be an irrelevant or benign message to Eve. In 
the usual steganographic protocol we assume that Alice 
and Bob have access to a secure, shared secret key. Al- 
ice uses this key together with an embedding function to 
hide the secret message, and Bob uses the same key to 
extract it. Alice can go a step further by first encrypt- 
ing the message and then hiding the ciphertext inside 
the covertext, generally at the cost of greater key usage. 
Bob, on receiving the stego-text would first extract the 
ciphertext and then decrypt it to obtain the final secret 
message, using the shared key for both steps. 
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Relatively little research has been done in quantum 
steganography. The idea of hiding secret messages as 
the error syndromes of a quantum error-correcting code 
(QECC) was introduced by Julio Gea-Banacloche in [3]. 
In his formulation Alice and Bob use the three-bit repeti- 
tion code to transmit classical messages to each other us- 
ing a shared secret key. All the noise in the channel that 
Eve perceives is because of these deliberate errors that 
Alice applies. In his model he assumes that Alice and Bob 
share a binary-symmetric channel. This work does not 
address the issue of whether the errors would resemble 
a plausible channel, nor does it consider the case where 
the channel contains intrinsic noise. Natori gives a simple 
treatment of quantum steganography which is a modifi- 
cation of super-dense coding [5]. Martin introduced a 
notion of quantum steganographic communication based 
on a variation of Bennett and Brassard's quantum-key 
distribution (QKD), hiding a steganographic channel in 
the QKD protocol 6J. Curty et. al. proposed three 
different quantum steganographic protocols |7]. 

In our earlier work [8] , we built on the approach of Gea- 
Banacloche in hiding information as errors in a quan- 
tum codeword. We showed that such schemes can hide 
quantum as well as classical information; we proposed 
a quantitative measure of "innocence" (or secrecy), and 
derived rates of secret communication for Alice and Bob 
under particular assumptions about Eve's knowledge of 
the channel, as well as key-consumption rates. We also 
addressed the issue of communicating over a channel con- 
taining intrinsic noise. 

The day may come when quantum networks are ubiq- 
uitous. Steganographic techniques may be useful as 
a way of authenticating quantum communications in 
distributed quantum information processing where the 
sender and receiver don't control all intermediate nodes 
of the network; such uses of steganography for authen- 
tication are often called "watermarking" in the classical 
case. Quantum steganography gives a different kind of 
cryptographic protocol that may allow both secret and 
secure communication of quantum and classical informa- 
tion over quantum channels. 

In Section |ll] we detail a protocol to hide four qubits 
in the [[5, 1, 3]] five-qubit code (the "perfect code"). This 
protocol works by hiding information in the codewords 
of the perfect code in such a way that to Eve they look 
like depolarizing errors. In Section III we numerically es- 
timate the optimal number of qubits that Alice can send 
to Bob on average using eight distinct encodings, and 
list the encoding using single-qubit errors. We calculate 
the key consumption rates in Section IV We then con- 



sider encoding into a longer sequence of five-qubit code 
blocks in Section|VJ and compare this to the theoretically 
achievable rate for a large block code. We show that en- 
coding across multiple blocks significantly enhances the 
secret communication rate, though it cannot quite match 
that of a large single code block. We conclude with a dis- 
cussion of these results. 
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FIG. 1. Encoding circuit for the perfect code. The H gate is 
a Hadamard gate, and the two-qubit gates are CNOT gates. 
The first four qubits are ancilla qubits and the fifth qubit |i/)c) 
is the cover-qubit. 



gi X Z Z X I 

g2 I X Z Z X 

g3 X I X Z Z 

g4 Z X I X Z 

X X X X X X 

Z Z Z Z Z Z 



TABLE I. Stabilizer generators gi, . . . , g4, and logical oper- 
ators X and Z for the perfect code. The convention in the 
above generators is that Y — ZX. 



II. HIDING QUANTUM INFORMATION IN 
THE PERFECT CODE 



We introduced a general version of the protocol that we 
present in this section in Ref. in [8^ , but this did not give 
examples of practical encoding techniques. In the cur- 
rent paper, Alice uses the [[5,1,3]] code (perfect code) 
to encode her stego-qubits in the syndromes of the code. 
The perfect code encodes one logical qubit into five phys- 
ical qubits, and is the smallest quantum error-correcting 
code that can correct an arbitrary single-qubit error [3]. 
It is a nondegenerate code: each single-qubit Pauli error 
is mapped to a unique syndrome. The code is a stabilizer 
code with n— fc = 5 — 1 = 4 stabilizer generators; we list 
them in Table |Tj along with the logical operators. Alice 
and Bob can hide up to four qubits of information in this 
code, which they send over a channel that to Eve looks 
like a depolarizing channel. Figure [T] shows the encoding 
unitary circuit for the perfect code. 

The stabilizer generators in Table |l] can also be repre- 
sented by a symplectic matrix, or Z\X matrix [lOl lllj. 
This is the following binary matrix: 



110 


110 


11 


10 1 



(1) 



This matrix is formed from the stabilizer generators in 
Table llj We obtain the the left Z (left) submatrix by 
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Syndrome 


Error 


Syndrome 


mil 


0000 


IIIIZ 


0001 


IIZII 


0010 


IIIXI 


0011 


IXIII 


0100 


IIXII 


0101 


ZIIII 


0110 


IIYII 


0111 


XIIII 


1000 


IZIII 


1001 


mix 


1010 


IIIIY 


1011 


IIIZI 


1100 


lYIII 


1101 


Yim 


1110 


IIIYI 


1111 



TABLE II. Syndrome table of the perfect code. The error 
operators are ordered according to syndrome values. 



inserting a "1" wherever we see a Z in the stabiHzer gen- 
erators. We obtain the X (right) submatrix by inserting 
a "1" wherever we see a corresponding X in the stabihzer 
generator. If there is a y in the generator, we insert a 
"1" in the corresponding row and column of both the Z 
and X submatrices. 

We can use this matrix to find the error syndromes cor- 
responding to single-qubit errors. To generate the syn- 
drome of each single-qubit error operator, we take the 
symplectic product of the parity check matrix [T] with the 
binary vector of the error operator corresponding to a 
single-qubit error. The perfect code has a total of fif- 
teen single-qubit errors: Xi, X2, . . . , X^, Zi, Z2, ■ ■ . , Z^ 
and Yi,Y2, ■ ■ ■ ,¥5. Together with the "no error opera- 
tor" mil these sixteen operators have sixteen distinct 
syndromes, which are listed in Tabic [llj 

We now detail the steps Alice takes to hide four stego 
qubits. We label Alice's subsystem that contains the 
five-qubit codeword as A, and the subsystem holding 
the stego qubits as S. Using the classical secret key she 
shares with Bob, Alice first applies a "twirling" operation 
to each of the four stego qubits. That is, she randomly 
applies /, X, Y, or Z to each qubit. To do this to four 
qubits requires 8 bits of secret key. (Note that if Alice's 
stego qubits are drawn from a source that looks like the 
maximally mixed state on average, twirling is not nec- 
essary. For example, highly compressed quantum states 
will look close to maximally mixed.) The combined A 
and S subsystems, after the twirling procedure but be- 
fore encoding, are in the state: 
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(g)|0000)(0000|(g)|Vc)(V'cl- (2) 



We can rewrite the S subsystem of the state in Eq. (pi) 
in the computational basis as: 



(gi4 



= ^Ei^)W' 



(3) 



where we denote the ket states from to 15 in place of 
their binary representations. We'll use the same notation 
for the four ancilla qubits in subystem A. Combining 
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FIG. 2. (Color online) Steganographic protocol to hide four 
qubits of information |^/)i), . . . , |'!/)4) using the perfect code. 
Using a classical secret key shared with Bob, AHce first applies 
the twirhng procedure (indicated in the figure by the yellow 
box) to each of her four qubits in the "stego subsystem" S. 
This transforms each qubit into a maximally mixed state. 
The codeword would be prepared using four ancilla qubits |0) 
along with a cover-qubit IV'c)- We call this "subsystem AP 
The first unitary U\ (blue box) is applied to the subsystems 
A and 5", followed by unitary W2 (green box). These have the 
effect of swapping the twirled stego qubits into the syndrome 
space of the code. Finally Alice applies the encoding unitary E 
to subsystem A and sends it over a channel to Bob. She traces 
out subsystem S (gray box), which now is just in the state 
|0). Upon receiving the codeword. Bob applies the decoding 
circuit T). He undoes the unitary transformations U\ and W2 
that were applied by Alice. Finally, he uses the shared secret 
key to untwirl the qubits to obtain the original stego qubits. 



Eq. ([3| with Eq. ([2| we get: 
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i;X]|fc)W''®|0)(0|^®l^c)(^c|^, (4) 
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fe=0 



Alice now applies the unitary U\ (shown in the blue box 
in Figure [2|, defined as 



u^^Y.\^^\'®^t®ot 



(5) 



where the Ei and Oi are the error operators listed in 



Table III ordered from top to bottom. The operators Ei® 
Oi transform under the encoding unitary of the five-qubit 
code into the correctable one-qubit errors of Table |TT] 
Note that the Ei operators act on the ancilla qubits so 
that filO) ex \i). 

We define the second unitary \Ji depicted by the green 
box in Figure [2] as: 
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Z^2^^(X^-)«®|j)(j|^®/^. 

J=0 



(6) 
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FIG. 3. Swap circuit of a qubit with an ancilla in state |0). 
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Syndrome Label 


nil 


I 


mil 


0000 


so 


IIIX 


z 


IIIIZ 


0001 


Sl 


IIXI 


I 


IIZII 


0010 


S2 


IIXX 


I 


IIIXI 


0011 


S3 


IXII 


I 


IXIII 


0100 


S4 


IXZY 


Y 


IIXII 


0101 


S5 


ZXXI 


Z 


ZIIII 


0110 


sc 


-IXYY 


Y 


IIYII 


0111 


S7 


XIII 


I 


XIIII 


1000 


Ss 


XZIX 


I 


IZIII 


1001 


sg 


XIXI 


X 


mix 


1010 


SlO 


XIXX 


Y 


IIIIY 


1011 


Sll 


XXIZ 


X 


IIIZI 


1100 


Sl2 


XYIX 


I 


lYIII 


1101 


Sl3 


YXXI 


z 


Yim 


1110 


Sl4 


XXXY 


X 


IIIYI 


1111 


Sl5 



TABLE III. Encoded error operators of the perfect code. 



In Eq. (jej) X^ is a shorthand notation for X^^ (g) X^^ (g) 
X^^ (g) X^'^, where ji ■ ■ ■ J4 is the binary expression for j. 
After applying the unitaries Ui and U2 , the system is left 
in the state 



P = 



1 ^"^ 

-T 
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^\k){k\<g>Ok\^c){^Jc\Ok. (7) 



k=0 



Note that the original stego qubits are now in the state 
|0). The quantum information they contained has been 
swapped into the syndrome subsystem. The unitary op- 
erators Ui and U2 are analogous to the two CNOT op- 
erators in the usual circuit for swapping a qubit into an 
ancilla in the initial state |0) (see Figure Isl). 

Alice then applies the encoding unitary Ue to sub- 
system A, and traces out subsystem S. The resulting 



codeword must look plausible to Eve. In this case she is 
trying to match the depolarizing channel: 



p^U{p) = {\-p)p+^-Y,X,pX,+Y,pY, + Z,pZ,. (8) 

The correctly-encoded, error-free state would be 

Pc=Ue (|0000)(0000| (g |Vc)(V'c|)Z^l. (9) 

By swapping in the stego qubits into the syndrome space 
as described above, Alice has effectively prepared the 
state 



15 

p'c = ^EkPcEk, 



(10) 



where the Ek are the single-qubit errors from TableO (in- 
cluding the "no error" operator Eq — II III) . To plausi- 
bly use the five-qubit code, the error rate p must be suf- 
ficiently low that it is rare for more than one single-qubit 
error to occur. So if Eve intercepts this state and checks 
the error syndromes, the result should look reasonable 
for a codeword that has passed through the depolarizing 
channel. 



III. AVERAGE RATE OF STEGANOGRAPHIC 
TRANSMISSION 

While the encoding given in the previous section is rea- 
sonable for encoding stego-qubits in a single codeword, 
it would not do if Alice wants to send many messages 
to Bob. It would quickly look suspicious if almost every 
codeword had exactly one single-qubit error. For longer 
messages, Alice must most often apply no errors, from 
time to time apply a single error, and perhaps occasion- 
ally apply two errors (an uncorrectable error), in such a 
way as to match the statistics of a depolarizing channel 
with error probability p. 

In this section we present details of how Alice optimizes 
the number of stego-qubits that she sends to Bob by en- 
coding her stego-qubits in the syndromes of the perfect 
code. She either sends no stego-qubits to Bob (and ap- 
plies no errors to the codeword) or she sends four stego- 
qubits to him (applying either one or two errors). We 
would like to maximize the number of stego-qubits that 
Alice can send to Bob under the constraint that Alice's 
encoding scheme should match the probability distribu- 
tion of the depolarizing channel. The channel model that 
we are interested in is: 



p^M{p)^{l-p)'p+P-^^-^ ' 



9 



J2 X,pX, + Y,pY, + Z,pZ, 



7 ^ ( ^i^jP-'fi^j + XiYjpXiYj + XiZjpXiZj 



i<j 



F,X,py,X, + Y,YjpY,Yj + Y,ZjpY,Zj + Z.X^p + Z,Xj + Z,F,p^,r, + Z,Z.,pZ,Zj 



(11) 



There are of course three, four, and five qubit errors, 
but it is very unHkely that such errors will occur, and 
so we neglect them for this paper. The techniques we 
give here could easily be used to find stego-encodings 
for those cases as well; but it might appear suspicious if 
Alice and Bob used an encoding that frequently suffered 
uncorrectable errors. 

We use three distinct classes of encodings. The first 
class corresponds to no errors, and transmits no hidden 
information. This always has the syndrome Sq = 0000 in 
Table inil 

Alice's second encoding class corresponds to all single- 
qubit errors, plus no error, with equal probability. These 
are the syndromes sq = 0000 to S15 = 1111 in the same 
table. This is the encoding described in the previous 
section. So this encoding class includes a single encoding, 
and transmits four stego-qubits. 

The third encoding class corresponds to the set of all 
two-qubit errors. There are ninety such errors. These 
ninety two-qubit errors naturally divide into six sets of 
fifteen errors each, where each set has one error corre- 
sponding to each of the fifteen nonzero syndromes. By 
also including the "no error" operator, each set corre- 
sponds to an encoding that can transmit four stego- 
qubits. We list these six sets in Table |IV[ When Alice 
sends four stego-qubits to Bob, she must use all sixteen 
distinct syndromes. A single row of this table, spanning 
all sixteen syndromes, corresponds to a single encoding. 
Each encoding proceeds exactly as described above for 
the single-error case, except that the operators 8i and Oi 
from Table IV are used in Eq. (Is]) instead of those from 
Table ini 

We now need to solve for how often the three classes of 
encodings should be used to match the channel statistics. 
Let Qo be the fraction of times Alice uses the (trivial) 
first encoding class; Qi the fraction of times that Alice 
uses the second (single-error) encoding class; and Q2 the 
fraction of times that Alice uses one of the six two-error 
encodings (which should be used equally often). The 
channel distribution constraints are as follows: 

Pa = [i-pf = Qo + ^{Qi+Q2). (12) 

Pi=5p(l-p)4-^Qi, (13) 

16 

P2 = 10p2(l_p)3 = ^Q2. (14) 

16 



P2 represent the total probability of the channel apply- 
ing no errors, one error, or two errors on the codewords. 
The right-hand-side of the equations represent how Alice 
matches the channel's probability distribution. For ex- 
ample, she always applies no errors if she uses the first 
(trivial) encoding, and with probability 1/16 if she uses 
one of the other encodings. We solve for Qo.1,2 to get: 



Qo =Po - (Pl +P2)/15, 

Qi - (16/15)pi, 
Q2 = (16/15)p2. 



(15) 



Note that these numbers do not add up to 1, because we 
have neglected errors of weight three or more. For small 
p they will come close. 

The average number of stego-qubits that Alice can 
send to Bob under the above constraints is Navg = 
4((9i + Q2) = (64/15)(pi +P2)- We plot this function 
in Figure |4] along with the Shannon entropy of the chan- 
nel (which is the maximum possible rate at which stego 
information could be sent). Note that this curve only 
makes sense for fairly small values of p; for higher values, 
it is no longer correct to neglect higher- weight errors. 



IV. KEY CONSUMPTION 

We define the key consumption rate as the number of 
classical bits of key consumed by Alice and Bob per qubit 
block. Alice can send an A^-qubit block to Bob by com- 
bining A'^/5 five-qubit blocks together. How much shared 
secret key do Alice and Bob require to send stegano- 
graphic information 
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to each other? In Section 
defined Qo as the probability of Alice using the first en- 
coding to send no stego-qubits to Bob. The probability 
of using the second encoding is Qi, when Alice applies 
single errors to her codewords. Alice and Bob can also 
use two-error encodings to send four qubits to each other, 
of which there are a total of six as shown in Table HVl We 
assume that each of these six encodings are equiproba- 
ble, each with probability (52/6. Therefore, there are a 
total of eight different encodings that Alice and Bob must 
choose from in order to send steganographic information 
to each other. 

For a single five-qubit block, Alice and Bob must share 
three classical bits to specify which of the eight encodings 
has been used. They also require an extra eight bits for 
In the channel constraint equations above, poiPii and Alice to construct her four twirled qubits and for Bob to 
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XYIII 




IXXII 


IXZII 




ZXIXZ 
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IXYZY 


IIXXI 


0101 


lYIYX 


IZIZI 


0110 


-lYXZX 


IZIYI 




IXIYI 


IIIYX 




IXXZI 


IIIZX 




-ZXIXX 


YIIIY 




lYXIY 


lYIIY 




IXIXZ 


IXIIZ 




-IXYZX 


IIYIZ 




-ZYXXZ 


YZIII 




XZZZY 


lYXII 




IXXXI 


IXIXI 




XIZIZ 


IIYYI 


0111 


IXXYX 


XIIYI 


1000 


XIIZX 


IXIZI 
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lYIIX 
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-IXXYZ 


IIIZY 




XIIIY 


IIIXY 




ZXXXI 
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-XZYZY 
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XIZXZ 


IIXZI 


1010 


XIXII 
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XIIXX 


IIIXX 




XZXII 


IZIXI 




XIIXY 


IIZIY 




XIYIZ 


IIXYI 




XIIXZ 


XIIIZ 




-YIXZY 


ZIIZI 




-YZXXZ 


ZYIII 




XXIII 


XXIII 




-YIYYX 


YIXII 




-XYZZY 


IZXII 


1011 


XZXXI 


IZZII 


1100 


YXIIZ 


YIZII 




XIXXI 


XIIXI 




-YXIIY 


ZIIIX 




XIXYX 


IXIYI 




XXZZI 


IIYIY 




-XIYXZ 


IIYZI 




XYIIZ 


lYIIZ 




XXZYY 


XIXII 




XYYZY 


IZYII 




YXIXZ 


YIIXI 




XYXII 


lYIXI 


1101 


XXIYX 


IIZYI 


1110 


xxxzx 


IIZZI 




XXZYZ 


IIYIX 




XXXIX 


IXIIX 




YXIXX 


ZIIIY 




XXYZI 


IIXIY 




XXIYY 


IIIZZ 




-XXXZY 


IIIYZ 




YYXXZ 


ZZIII 




mil 


mil 




-XXYYY 


XIYII 




mil 


mil 
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XYXXI 


lYZII 


0000 


mil 


mil 




XXYYZ 


IIXIX 




mil 


mil 




XXXXY 


IXIIY 




mil 


mil 




YXXXI 


YIIIZ 




mil 


mil 



TABLE IV. Table of double-qubit errors. The error operators in bold represent a single encoding. The table represents a 
total of six different encodings where each encoding utilizes sixteen distinct error operators and their corresponding distinct 
syndromes. 
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FIG. 4. (Color online) The red curve shows the Shannon 
entropy of the binary-symmetric channel. The blue curve 
underneath the entropy curve is the rate of steganographic 
information maximized for various values of the error-rate p 
of the channel. In the limit of large A^, encoding in a single 
large block (rather than multiple sub-blocks) can achieve a 
rate of steganographic transmission approaching the Shannon 
entropy [S]. 



untwirl these qubits once he receives the steganographic 
information. So Alice and Bob would consume twelve 
classical secret key bits for each five-qubit block, if they 
encode one block at a time, and so for an A^-qubit block 
they would consume at most 127V classical bits of key — 
not a very economical protocol. In fact, it would be less 
than that, since Alice needs no key bits to do twirling for 
the first, trivial, encoding. Taking this into account, the 
total key consumption rate would be (3 + 8{Qi + Q2))/5 
secret key bits per qubit. 

However, Alice and Bob can do much better than this 
by encoding into multiple block at once. In the limit of 
large N, the number of bits that they require to specify 
the key is given by the Shannon entropy of the probability 
distribution of the three different encodings. This gives 
us a key usage rate of 



K^^ i-Qo log2 Qo - Qi log2 Ql ~ Q2 log2 Q2/6) (16) 



key bits per qubit. For small p this dramatically 
outperforms the rate for encoding one block at a time. 



V. ASYMPTOTICS 

We would like to quantify the steganographic rate 
when Alice sends a large block code to Bob. We de- 
pict the asymptotic scenario in Figure [5] The chan- 
nel has no intrinsic noise of its own. Whatever noise 
that Eve observes on the channel is due to Alice. We 
address the problem of where the channel has intrin- 
sic noise in [5]. The 7V-qubit block code is constructed 
by concatenating M five-qubit blocks. Alice hides her 
steganographic information in the A^-qubit block, and 
we would like to estimate the number of stego-qubits per 
A^-qubit block that Alice can send to Bob while match- 
ing the statistics of the depolarizing channel. Because of 
the low error-rate of the channel most of the time Alice 
applies no error to her M code blocks. This corresponds 
to syndrome sq from Table [Till Occasionally she applies a 
single error. We label each five-qubit block by qj, where 
j G {1,2,..., M}. Each aj corresponds to one of the syn- 
dromes from Table |III| In this section we define a string 
to be a string of syndromes for a concatenated M five- 
qubit blocks where each five-qubit block is labelled by its 
corresponding syndrome. 

Let pq — {I — p)^ be the probability of no error on 
a block. Let pi — 1 — (1 — p)^ be the probability of 
a single error on a block. For small values p we can 
approximate Pq = (1 — 5p) and pi = 5p. If Alice hides 
information in typical sequences then the total number 
of such sequences is approximately 2^^^p\ where H{p) 
is the Shannon entropy of the channel. So the number 
of qubits that Alice can hide with this encoding will be 
approximately MH{p). We first calculate the Shannon 
entropy H(p): 



H{p)^-{l-pf\og^{l~pf 



(17) 



15 



l-{l-pf 



l0g2 



I-(I-P)' 



15 °^ V 15 

« -(1 - bp) log2(l - hp) - 5plog2 bp + 5plog2 15 . 

The above is an approximation because we ignore the 
contribution to the Shannon entropy from double and 
higher errors. We define the steganographic rate as the 
number of steganographic qubits that Alice sends to Bob 
per A^-qubit block. In our case A^ = 5A/. So the rate 
R^yp = \og^2^-'"ip)lbM. We can expand this further 
and write: 

Rty^ ^ ~^log2(l - 5p) +plog2 { ^^^ 'p^^^ ) ■ (18) 



The total probability pk of all strings of weight k is: 

k 
I IVl \ I L — (I — pj" \ 

Pk 



(tO(i^^)'a-rt«"-"i^'.w 



M\ fp 



k 



M-k-i rk 



{l-bpf'-^lb 



The average number of errors in an A'^-qubit code block 
goes like hMp. Let the variance be hMpS, where < 



(5 < 1. For each k from 5pM{l - 5) to 5pM(l + 5), Alice 
can choose Ck strings of weight fc. Let 



5Mp(l+(5) 
fe=5Mp(l-(5) 



(20) 



Define the probability q = 1/C. Then we would like to 
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FIG. 5. (Color online) Alice sends a total of Af blocks con- 
sisting of A'' = 5M qubits. We label each block with its cor- 
responding syndrome, ao, ai, . . . , am- Each aj corresponds to 
a syndrome from Table |III| To obtain the syndrome for the 
A-qubit block we simply concatenate the syndromes. 



satisfy: 



qCk = Ck/C^Pk 



(21) 



The choice for the number of strings of weight k cannot 
exceed ( j, ) , and so C^ < { ^)- From this constraint we 
obtain 
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FIG. 6. (Color online) The green curve for Rty-p outperforms 
the rates from the syndrome encoding (black) and the local 
encoding (blue). To generate the black curve we chose 5 = 
0.005. 



g> 



(1 - 5p)^-'=15'=. 



(22) 



Alice would like C to be as large as possible which means 
that q must be as small as possible. This further implies 
that we should set k — 5pM (1 — (5). This give us 

C « (p/3)"''*^P(^"''^(l - 5p)5AJ'p(l-<5)-M-[^g-5Mp(l-5) 

(23) 
So the steganographic rate for this encoding R^nc ~ 
\og2C/5M. Finally, 



Rene ~ - -^ l0g2 ( 1 - 5p) + P log2 

5 



il-5p){5pY 
5p{l - bp)^ 



(24) 



We plot the local encoding from Section ITTTj along with 
Rtyp and Rene for low values of p in FigurelB] As expected 
the typical sequences encoding outperforms the local en- 
coding as well as the syndrome encoding described above. 
However, we do much better asymptotically with the cur- 
rent encoding as opposed to the local encoding. 



VI. SUMMARY AND CONCLUSION 

Steganography is the art of hiding information by dis- 
guising it as something else. This idea, developed in 
the classical sphere, can be adapted to hide quantum as 
well as classical information — in this case, by making the 
quantum information appear to be errors from a quan- 
tum depolarizing channel. Alice and Bob conceal their 



communication from Eve, hiding their message as errors 
in a codeword for an "innocent" cover state |V'c)i and us- 
ing the resource of a shared secret random key. (Shared 
entanglement would work as well, or even better.) 

In this paper, we have made use of the ideas from our 
earlier work [S] for a particular finite code: the five-qubit 
"perfect" code. We have explicitly presented the encod- 
ings needed to simulate the quantum depolarizing chan- 
nel, and calculated the rate of transmission of stegano- 
graphic qubits and the rate of usage of the shared se- 
cret key. While we only worked out encodings that ap- 
pear to be single-qubit or two-qubit errors, the same 
techniques of this paper will readily yield encodings for 
higher-weight errors as well. 

All of this work assumed that the underlying physical 
channel used by Alice and Bob is error-free. It merely 
appears noisy to Eve because of the machinations of Al- 
ice. In principle, steganographic information can still be 
hidden even if the underlying channel is noisy. This re- 
quires an additional layer of error correction, to protect 
the hidden information from physical noise. In practice, 
these encodings are not necessarily straightforward, since 
errors that are local in physical space may appear quite 
differently in the space of syndromes of the code for the 
covertext. The details of such encodings, and what rates 
can be practically achieved, remain work for the future. 
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